0

I have heard that Windows (10) local accounts are not that secure. I am however particularly wondering whether the password can be retrieved using any tools.

So I am not talking about resetting it using whatever means necessary. I am talking about retrieving the password in plain form.

1

By default, Windows hashes all passwords with what Microsoft calls NThash (sometimes called NTLM hash), which is just MD4 of the UTF-16-LE (little-endian) representation of the password.

Technically, MD4 is a one-way hash, so no, it is not possible to retrieve the password from this. However, the way it's used is very weak, so it's usually possible in practice to reverse the hash.

  • Rainbow tables: The passwords are not salted before hashing, so a given password will always product the same NThash on any system. This means they can be pre-computed in giant lookup tables (sorted by hash digest to enable binary search) called "Rainbow Tables". There are many rainbow tables on the web, or you can build your own if you've got a bunch of time to kill. While a rainbow table can never store every possible hash value - MD4 digests are 128 bits long, which means 2^128 possible values, which is quite beyond the capacity of all data storage currently in existence or likely to exist - they can certainly store billions of likely passwords and that makes all but the longest/most obscure passwords crackable in practice.
  • Hash brute-forcing programs: Hash algorithms like MD4 are designed to run quickly, and MD4 in particular is nearly 30 years old so you can get tens of thousands of times as much computing power for the same amount of money as you could back then. That means it is possible to compute hashes extremely quickly, especially if you have a processor that is capable of quickly executing the same instructions (the steps of MD4) on multiple data (candidate passwords) in parallel, and collecting the results into one organized output. This (single-instruction-multiple-data or SIMD operation) turns out to be how GPUs work. A single high-end GPU can compute billions of hashes per second, and there are programs that you can run which will use your GPU to try to brute-force a password hash. Even without a rainbow table, you can brute-force most passwords very quickly if you have a good graphics card.

Windows can also be configured in two non-default ways, which would make this task even easier:

  1. The legacy "LM" or "LANMAN" / "LAN Manager" hashing algorithm makes MD4 look modern and secure. LM hashes can only be used on passwords up to 14 characters in length, and only because the actual operation is performed on pairs of 7-character chunks with the results concatenated. It also only supports a limited set of input characters (notably, it upper-cases the password before hashing). As a result, you can brute-force each half of an LM hash separately and extremely quickly; your typical CPU can brute-force any LM hash in under a minute. LM hashes are disabled by default on all recent versions of Windows (and not used even on older versions like XP if you used a password at least 15 characters long) so you're extremely unlikely to find one on Win10, but I think it's still possible to enable them.
  2. Windows supports the ability to store passwords under reversible encryption, rather than hashing. This allows any Administrator user to retrieve any user's password, because apparently some of MSFT's customers wanted this ability really badly. It's a terrible idea and should never be enabled, because in addition to letting admins see user passwords, it lets anybody who can access the hard disk and knows how to retrieve the machine key and the encrypted passwords also see the user passwords (and there are tools for this). It's very unlikely that the passwords on any given Windows machine are stored this way, but if they are, then it is in fact possible to directly retrieve them if you have admin-level access to the system or physical access to its system volume.

EDIT: As HackneyB points out in the comments, Microsoft couldn't pass up an opportunity to add some useless obfuscation on top of their antiquated password hash, so they wrap it in multiple layers of futile encryption (futile because the keys are either stored in plain text or derivable from plain text values, so it doesn't matter in the least which ciphers or how many layers are used). Stripping away the obfuscation, though, the only actual cryptographic protection against reversing the passwords is that single-round unsalted MD4 hash.

  • Ah okay, so the password is only considered unretrievable if it is sufficiency long/complex to the point where it would take millions of years to brute force it? – user198611 Mar 2 at 22:40
  • Well, a password that is long/random enough to take a GPU cluster 10 years to crack (or a typical PC at least a century) is irretrievable for most practical purposes today. For that matter, due to the way hash functions work, you're not guaranteed to find the original value even if you find some value that produces the same hash digest, it could be a collision (though this is extremely unlikely in practice, even with an older algorithm like MD4). "Considered irretrievable" isn't really a hard threshold, though. Your typical sysadmin and the NSA have very different amounts of resources. – CBHacking Mar 3 at 0:03
  • This is using outdated information potentially - in 2016 Windows 10 updates removed use of RC4, MD5 and switched to using AES based ciphers for password storage. As a result a brand new install of Windows 10 is not as "easy" to crack as an installation from before 2016, and some of the cracks available for legacy encryption standards of pre-Windows 10 OS and pre-July 2016 versions of Windows 10 don't work. – HackneyB Mar 3 at 1:09
  • @HackneyB Do you have a reference for that? Because nothing I said mentioned RC4 or MD5, and only the last part (the "don't-ever-use-this" option to store passwords reversibly) would involve AES (or RC4) in any way. I'm pretty sure you're thinking about something that is not storage of local account passwords. Are you maybe thinking of perhaps DPAPI (which is an API that apps can use to store things like passwords), or generic CryptoAPI updates? – CBHacking Mar 3 at 4:04
  • I'm basing my comment on (personally UNverified) evidence that older cracking tools don't work on newer versions of Windows and on posts here, as well as externally that indicate AES is now used to encrypt hashes. Here's a very detailed post that I frankly haven't digested: insecurity.be/blog/2018/01/21/…. I would like to have clarity on what is the best current hashing method in fully patched, post-anniversary update Windows 10. What hash method + AES to encrypt the hash? – HackneyB Mar 3 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy